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a collector foncollecting data traffic statistics from agents operating on other 
devices in the network and a proxy for receiving configuration packets from a manager and 
communicating configuration d\ta to said agents. 

11. The apparatus according to claim 10 wherein said bridge collector 
forwards traffic statistics to a domain proxy. 

12. The apparatus according to claim 10 further comprising a means for 
generating at said collector traffic statistics for multicast packets, 

13. A local area network comprising; 

a plurality of end systems, each with a connection to a network segment wherein 
j said end systems are capable of transmitting Mata on said segment and wherein at least one of 
| said end systems includes an agent for collection of traffic statistics; and 

a plurality of collectors having connections to receive data from at least one agent 
V in said ESs or from at least one other collector. 



14. The local area network according to claim 13 wherein said collectors are 
{ further capable of detecting multicast packets and compiling traffic statistics on said packets. 



15. The local area network according ta claim 13 wherein said collectors are 
further capable of receiving probe configuration packetsVfrom a network manager and then 
sending configuration packets to each individual agent inthe network. 



16. A method for distributed remote network monitor (dRMON) in a LAN 



comprising: 



deploying dRMON agents within ESs said agents implementing prior art RMON 
functional groups but only capturing and analyzing packets thattheir native ES sends or receives; 

on a regular, periodic basis having the dRMON agents forward statistics and/or 
captured packets to a dRMON proxy or collector, existing somewnere on the WAN/LAN; and 

combining received agent data thereby creating at thaproxy the view that a prior- 
art stand-alone RMON probe would have if all the ES were on the same LAN segment with it. 
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17. The method according to claim 16 wherein said proxy can mimic the SNMP 
responses of a prior art nonMistributed RMON probe so that existing network application 
management software can interact with the proxy as though the proxy were a prior art probe. 

18. The method according to claim 16 wherein in a default mode, ESs in the 
same multicast domain are treated by a proxy as though they are on one LAN segment to RMON 
applications to interact with the proxy as though it were a prior art probe and in an enhanced 
dRMON Managers a user is provided with the ability to combine ports and hosts in order to 
create Virtual LAN (VLAN) definitions to cause the monitoring function to behave as though all 
selected hosts were on the same LAN segment being served by the same RMON probe with the 
dRMON collector in this embodiment creating and maintaining several such views with each 
appearing as one interface to conventionaRRMON Management applications. 

19. The method according ta claim 16 whereby said agents perform continual 
response time monitoring and forward the results to the Proxy. 

20. The method according to claim 1 6 whereby said agent software utilizes native 
OS APIs to gather information about the ES thaucould not be via packet capture and analysis, 
such as: (l)Network protocol stack configurationsWd NIC configurations including problematic 
situations; (2) Application information ranging from what protocols an application is bound to, to 
its manufacturer, version, file date and time, DLLs used and their versions, etc.; (3) System 
information such as memory, CPU, disk space, currenf resource utilizations, etc.; and (4) System 
performance metrics. 



21. An agent for distributed network monitoring comprising: 
an RMON Engine for receiving a packet stream coming from a DTA and 
subjecting it to RMON analyses as configured via the proxy; 

RMON Data Structures; 
filters; 

an event generator; 



Down-Loadable-Modules manager; 



Alt 



Pi 



3 



^5 w 



n 



\ 

I. M 



Fletcher et al. 

Application No.: Not AssijSRd 
Page 5 





PATENT 



dRMON Interface Module; and 
a protocol interface l^yer. 

22. The agent of claim 21 implemented in the C programming language with 
executable code launched each time ES ia started or rebooted and the agent may be tightly bound 
to ES adaptor driver software. Because thevdRMON agent has no visible ES user interface, the 
ES user is totally unaware of the agents presence. 

23. A proxy for distributed network monitoring comprising: 

an agent discovery engine for automatically discovering all of the dRMON 
Agents within its management sphere; 

a time-stamper for stamping statistics and packets received from agents; 

an agent configuration for setting how\nuch memory/storage to reserve for 
RMON data space, version management, etc.; 

an RMON configuration for setting filters, historical sampling intervals and other 
MIB-defined user-settable options; and; 

an updater for automatically updating agents \ia the network. 



24. (New) A method for the distributed collecting of network data traffic 
statistics, wherein said network comprises end systems (ES) connected to network segments, the 
method comprising: 

capturing network data at a plurality of said ESs, wherein each of said plurality of 
said ESs captures only network data that said each of said plurality of said ESs sends or receives; 

computing individual network traffic statistics at said plurality of said ESs, said 
individual traffic statistics being extracted from analysis of said captured network data; 

transmitting data containing said individual traffic statistics to a collector from 
said plurality of said ESs; 



compiling said individual traffic statistics from individual ESs into group network 



statistics; and 



providing reports based on said compiled statistics, from said collector, to a 



network manager. 



